Live › vulnerability › CVE-2026-121407
FreeRDP's shadow server has an inverted PDU length check in its remdesk thread, so a crafted payload makes the process abort on a Stream_Seek assertion. An authenticated client can take the server down and drop active sessions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:21 UTC. All times on this page are UTC.
Teams running a FreeRDP shadow server, which shares a live desktop session over RDP, are exposed because the crash is triggered by a connected client. Systems that only use FreeRDP as a client, or that do not run the shadow server, are not in the described path. Exposure needs an authenticated session, so the risk is highest where many users can connect.
No product ranges from the sources yet.
xfreerdp --version or the package manager, and see whether it is below 3.32.2freerdp-shadow) is running and accepting connections3.32.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server's remdesk_server_thread that allows authenticated clients to crash the process via an inverted PDU length check. Attackers can send an 8192-byte remdesk payload declaring an eight-byte PDU length to trigger a fatal Stream_Seek assertion, aborting the server and dropping sessions.
This page as .md · .json · in your agent: get_signal("CVE-2026-121407")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.